Codex Desktop on Windows misdiagnoses workspace permission denial as Access database lock and claims hidden UI is visible

Environment

• Codex Desktop on Windows
• Local projectless task
• Work involved a Microsoft Access frontend stored outside the task's current writable workspace roots
• Date observed: 2026-08-17

Problem

During a long-running task, the agent repeatedly gave the user incorrect operational guidance after the desktop session restarted:

1. A DAO OpenDatabase write attempt failed with Access's combined “file opened exclusively or insufficient permissions” message.
2. No .laccdb file existed and no visible Access instance was open.
3. The actual cause was that the post-restart Codex filesystem context no longer included the external project directory as a writable root.
4. The agent initially diagnosed the error as an Access lock and repeatedly asked the user to close/reopen Access.
5. The agent launched MSACCESS.EXE from its execution context, observed a process/window handle, and told the user the official frontend was visibly open. The user could not see it because the process was created in a different/noninteractive desktop context.
6. It then made the user create a blank form manually and repeat close/open steps before correctly identifying the permission boundary.

User impact

• Repeated unnecessary manual actions.
• Loss of confidence in the agent.
• Risk of leaving hidden Access processes and database locks.
• Confusing distinction between the official production file, backup copies, workspace roots, OS ACLs, and sandbox permissions.

Expected behavior

Before diagnosing a local database lock, Codex should:

• Inspect the current writable roots after a restart or context refresh.
• Distinguish OS/sandbox UnauthorizedAccessException from file-sharing violations.
• Check for Access lock files and processes before telling the user the file is locked.
• Never claim a desktop application is visibly open based only on a process or window handle when the user and tool may be in different interactive sessions.
• Avoid repeating manual user steps when the underlying permission condition has not changed.
• Preserve the user's explicit instruction to work only on the official file and not drift into copy-based workflows.

Suggested guardrails

• Surface filesystem-root changes after restart/compaction to the agent.
• Provide a first-class permission request mechanism in the active tool list when external project paths are in scope.
• Warn when GUI processes launched by tools cannot appear in the user's desktop session.
• Encourage an explicit read/write probe that reports permission denial separately from application-level lock errors before remediation guidance.

Start by reproducing the post-restart filesystem-context behavior for an external project path and the GUI process launch described in the report. Trace how current writable roots, permission failures, lock checks, and desktop-session visibility are surfaced to the agent. Done means the agent distinguishes permission denial from database locks, does not claim hidden applications are visible, and avoids repeating ineffective user steps.